Privacy Policy

1. Information involved

• Account and security information: name, email address, password hash, verification status, two-factor settings, sessions and device-session metadata. If you choose Google sign-in, Dunsly receives the identity information used to create or link that account, not access to your Gmail messages.
• Optional personal demographics: age range and sex, only if you choose to answer during signup. These describe your individual account, not your household. You can skip both; they do not change your price or budget categories.
• Household and planning information: membership and roles, budgets, categories, goals, cash plans, recurring items, notes and optional setup answers such as housing, relationship, children, pets and financial priorities.
• Financial records: accounts, balances, transactions, merchant descriptions, dates, categories, ownership labels and available debt or statement details that you enter, import or authorize a bank-data provider to supply.
• Advisor and communications: questions, generated responses, supporting financial context, service-email content and delivery status, and information you choose to include in a support request.
• Technical records: request and error information, IP addresses, browser or device details, security events and service logs needed to operate and troubleshoot the website, and a record of which days you used the web or iOS app (not what you viewed).

Not every category is collected from every person. Visiting the public landing page does not create a finance account or connect a bank. Data can come from you, other authorized household members, your selected connection provider or the systems that operate Dunsly.

2. How information is used

Dunsly uses this information to sign you in, keep household records separate, produce financial summaries, synchronize authorized accounts, support your chosen planning features, deliver security emails and investigate service problems or misuse.

Authorized Dunsly staff can see account details (name, email, sign-in and security status, household membership, plan and bank-connection status) to provide support, and statistics computed across many households, such as a typical net worth or the share of spending by common category, to run and improve the service. These statistics are only shown for groups of several households and are rounded so they do not describe any one household. Staff tools do not display an individual household's balances, transactions or advisor conversations; staff access requires two-factor authentication and is logged.

When enabled, billing records support subscription access and payments; advisor context supports the questions you submit. Information may also need to be preserved or disclosed to comply with a valid legal requirement or address a security incident. This draft does not authorize unrelated advertising use of financial records.

3. Shared households

Financial information placed in a household is shared with its authorized members according to their permissions. Members may contribute or change information about the household. An owner’s export can include household advisor records as well as finance data; do not assume a chat is private from the household owner.

Spending-owner labels organize transactions. Privacy mode hides amounts on screen. Neither is a separate access restriction within the household. A person who has exported or copied information may retain that copy after their access is removed.

4. Providers and optional features

Operating providers receive the information needed for the feature they supply. Their own notices also apply to information they collect directly.

• Bank connections — Plaid: where bank linking is enabled, Plaid handles the connection flow and returns authorized account data. Dunsly stores connection identifiers and encrypted access tokens for that integration, rather than collecting your bank password in its own forms. See Plaid’s privacy information.
• Transactional email — Resend: recipient addresses and message content are sent to Resend for verification and password recovery. Delivery events may be available to Dunsly. Open and click tracking are disabled for these authentication emails.
• Hosting and operation: Railway hosts the public landing site and staging services. The private preview runs separately. Hosting, database and backup systems process the data stored in their respective environments; a public landing-page visit does not expose the private preview’s records.
• Optional Google sign-in: Google authenticates the identity you choose to link. Using this option is not permission for Dunsly to read your Google Drive or email.
• Optional AI advisor: when configured and enabled by a household owner or admin, Dunsly sends questions and relevant financial summaries or selected records through OpenRouter to the configured model provider. This can include merchant and transaction details. Disabling advisor consent stops new use, but does not itself erase previously stored conversations or recall information already processed. Provider-specific retention and training terms must be confirmed before a public AI launch; this draft makes no promise of zero retention or no training by an external model provider.
• Subscription payments — Stripe: the current preview does not offer public paid subscriptions. If activated for a paid launch, Stripe will handle checkout; Dunsly will receive subscription and payment-status identifiers needed to administer access. A test checkout is not a real charge.

5. Cookies and browser storage

The web app uses session and security cookies. Browser storage also supports preferences and current workflow state, including appearance, selected household, transaction-search text and short-lived bank-linking state. Blocking this storage may stop sign-in or other features from working.

The landing page at dunsly.com uses Google Analytics to measure visits and interactions. It loads Google's analytics script and uses cookies restricted to that hostname, with advertising personalization and Google signals disabled. This tag does not run on staging.dunsly.com, app.dunsly.com or local previews. Fonts remain self-hosted, and no session-replay service is installed.

The finance app does not persist private financial API responses in an offline cache. This does not mean that your browser contains no personal information: session cookies, entered searches, temporary connection state and files you download need appropriate protection on shared devices.

6. Retention, disconnection and deletion

Household financial and planning history remains available while the household exists; it is not automatically deleted merely because it is old. Disconnecting a bank revokes continued access through that connection after provider confirmation, while retaining records already imported.

Eligible account deletion removes the user and their sole-member, owner-held households from the active database and revokes their sessions. Self-service deletion can require resolving shared membership, live bank connections, uncancelled paid subscriptions and protected migration archives first. This is not a blanket exception to applicable deletion rights.

Logs, provider records, backups and protected migration copies have separate lifecycles. Deleting active records does not instantly remove every older copy. Production retention periods and the process for removing retained copies must be finalized before public launch; no universal deletion deadline is promised by this draft.

7. Security

Dunsly uses account authentication, household-scoped access controls and revocable sessions. Bank integration tokens are encrypted within the application. These measures reduce risk but do not make any service immune to unauthorized access, loss or interruption.

Use a unique password, enable available two-factor authentication and protect exported files. Never include a bank password or one-time code in an advisor message or privacy request.

8. Your choices and requests

The web app provides financial-record editing, household-owner export, bank disconnection and eligible account deletion. Look under Security & your data and Connections for export, disconnection and deletion. Those three controls remain available even when email verification or billing steps are incomplete; access to financial editing still requires the usual account permissions and access checks.

Depending on your location and which laws apply, you may have rights to obtain, correct, delete or receive a copy of personal information, or to challenge a decision about a request. An identity or authority check may be necessary to avoid exposing another person’s records. Product restrictions do not replace legal rights.

Privacy contact pending: a monitored request channel, the legal operator’s identity and any required mailing address must be published before this policy takes effect. There is not yet a confirmed public privacy mailbox in this draft. A sending address on an automated email is not necessarily a monitored inbox.

9. Audience and service changes

The current app is a limited financial-management preview, not a service designed for children. The launch age and geographic eligibility rules must be confirmed before public registration; this draft does not claim that an age-verification system is in place.

The date above identifies this draft. An effective policy must reflect the actual launch environment, provider arrangements and retention procedures. Material changes in data use will require an updated notice and any consent required by applicable law. Native-app disclosures and legal navigation are outside this web-only release.